Providers must retain automatically generated logs under their control

Practical action

Configure log retention for hosted or API-served high-risk systems to at least six months with a documented rationale for any longer period.

Who does it apply to?

Providers that host, operate or otherwise hold the logs of a high-risk AI system; deployers have the parallel duty in Article 26(6).

Actors

Provider / developer

Sectors

Cross-sector / all sectorsFinancial services and credit

Use cases

Biometrics and facial recognitionAI in finance, credit and insuranceSafety-critical and infrastructure

Applies from: 2 December 2027

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesTechnical measureEngineering lead · continuous
  Automatic event logging and record retention

  Serves 9 recorded duties · evidence: AI system event logs, Log schema and retention standard, Log integrity and retention check

  Retention of Article 12 logs for the required period.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI System Inventory

  Register · XLSX and DOCX · v6

• EU AI Act Role and Risk Classifier

  Checklist · XLSX · v4

• AI Agent Registry and Permission Matrix

  Register · XLSX and DOCX · v6

• EU AI Act Article 50 Transparency Kit

  Kit · DOCX and XLSX · v44

All 10 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Providers must retain automatically generated logs under their control (EU AI Act)” [AIPT-OBL-0025, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0025 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0025: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

@misc{aipolicytracker2026_providersmustretainautom,
  author       = {{AIPolicyTracker}},
  title        = {{Providers must retain automatically generated logs under their control (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Design high-risk systems to log events automatically — EU AI Act, European Union
• Providers must keep high-risk AI documentation for ten years — EU AI Act, European Union
• Keep records of consequential decisions influenced by the technology for three years — Colorado ADMT law (SB 26-189), Colorado (United States)